WO2022139078A1 - Apparatus for providing e-mail security service using hierarchical architecture based on security level and operation method therefor - Google Patents

Abstract

A method for operation of an apparatus for providing an e-mail security service according to an embodiment of the present invention comprises: a collection step of collecting mail information being transmitted and received between one or more user terminals; a security threat inspection step of processing step-by-step matching of a mail security process corresponding to the mail information, according to a preset security threat architecture, inspecting the mail information by the matching-processed mail security process, and storing and managing mail security inspection information according to the result of the inspection; a mail processing step of processing a mail status according to security threat determination information being acquired via analysis of the mail security inspection information and the mail information; and a record management step of storing and managing, as record information, the mail information which has been processed according to the security threat determination information.

Description

Device for providing e-mail security service using hierarchical architecture based on security level and method for operating the same

The present invention relates to an apparatus for providing an email security service and an operating method thereof, and more particularly, to an email using a security level-based hierarchical architecture capable of detecting and blocking cyber threats such as malicious code infection and social engineering hacking through email It relates to a security service providing apparatus and an operating method thereof.

In today's society worldwide, with the development of computers and information and communication technologies, the dependence on cyber is increasing in all areas of social life, and this is a trend that is accelerating. In recent years, 5G mobile communication with high-speed, ultra-low latency, and hyper-connectivity has been commercialized and new services based on it have emerged, making cybersecurity more important.

Technology fields such as the Internet of Things (IoT), cloud systems, big data, and artificial intelligence (AI) are providing a new service environment in combination with information and communication technology. A system providing such a service can be used in real life by being connected to a PC or a portable terminal device through a wireless Internet network or the like.

As such information and communication technologies connected to various terminal devices or communication devices become closer to real life, cyber security threats with malicious intent are increasing day by day by using them. Sophisticated and sophisticated cyber security threats can cause damage such as stealing and damaging information by causing abnormal execution of information and communication terminal devices of organizations, institutions, or individuals, or by inducing human error through forgery and forgery of management information. . In addition, information obtained illegally through cybersecurity threats can be used to commit money fraud and other economic and social crimes.

In order to block and respond to cyber security threats, an information protection system that protects and manages systemized information and communication technologies can be utilized. The information protection system can be built according to the system type or technical characteristics of information and communication technology to respond to various cyber threats and can be applied in stages.

The e-mail system used in information and communication technology can provide an e-mail service including a body of content so that a message can be exchanged between users using a communication line between users through a computer terminal. In this case, an electronic file including content to be shared may be attached to the e-mail, or a website connection link (URL; Uniform Resource Locator) may be written in the body or inserted in the attached file.

As such, an executable electronic file containing malicious code may be attached with malicious intent through the e-mail system, or a URL that may link to a specific website may be inserted. Through this, by allowing the e-mail recipient to execute malicious code or access the forged website through the inserted URL, information processing not intended by the user may be performed and information may be stolen.

In order to respond to email security threats that can cause economic and social damage and can be linked to various crimes, as in Korean Patent Registration No. 10-1595379, 'a system for controlling and blocking e-mails with malicious codes' is disclosed. . The registered patent includes a function of receiving an e-mail from a target system when an e-mail sent from an external server or terminal is transmitted via a firewall and a spam blocking device having a built-in anti-spam software; The system checks whether there is an attachment. If there is no attachment, the e-mail is sent from the target system to the mail server. ), the function to prevent malicious code infection by blocking the e-mail in advance, and if the attachment file type is an image, the image cannot be converted, so malicious code infection is impossible, so the e-mail is transmitted from the target system to the mail server. , If the attachment type is a document, the document is converted to a PDF format that cannot be modified and the email recipient clicks on the URL that reflects the malicious code inside the document to prevent malicious code infection in the user's terminal in advance. The function of sending a notification mail by selecting a single or plural number among e-mail, messenger, mobile, and KakaoTalk from the target system to the user's terminal. In the case of , it is processed in the above manner, in the case of a document, it is converted to PDF and processed in the above manner. The function to send notification processing from the target system to the mail server by selecting single or multiple notification emails from among e-mail, messenger, mobile, and KakaoTalk, including the results, and attachments that require malware inspection in addition to executable files in the target system a target system having a function to process malicious code inspection and treatment by transferring the . Virtual BOX, which receives the executable file from the target system, constitutes a virtual environment as a separate system, and is equipped with various types of malware treatment solutions to process malicious code inspection and treatment hidden in the executable file, and send the result back to the target system a Virtual BOX that delivers and restores to the environment before the test; a mail server having a function of receiving an e-mail (including a notification mail) from the target system and delivering an e-mail (including a notification mail) to a user terminal; Malicious comprising; a user terminal having a function for a user to select whether to accept or reject an original e-mail through confirmation of a notification e-mail when receiving a notification e-mail from the target system, and a function to log in and check the received e-mail; It describes a system for controlling and blocking e-mails with attached codes.

However, the system for controlling and blocking e-mails with such malicious code is limited to the response system at the receiving side of the e-mail. There is a limit to the countermeasures against cyber security threats on the processing side.

In addition, since it is limited to PDF conversion for malicious code and forged URLs planted in attachments attached to e-mails, and inspection and treatment of executable files and attachments using a virtual environment, it is possible to apply e-mails disguised as similar domains and social engineering attacks. There may be limitations in threat diagnosis and response, such as relationship analysis.

The present invention is to solve the above conventional problems, and cyber security such as spam, hacking, fraud, etc. that can be considered in terms of incoming mail, outgoing mail, in-system mail processing, user terminal device, etc. processed in an email system An object of the present invention is to provide a device for providing an email security service capable of responding to cyber security threats in stages and controlling and managing the email system using a security level-based hierarchical architecture against threats and an operation method thereof.

According to an embodiment of the present invention, there is provided a method for operating an apparatus for providing an email security service, comprising: a collecting step of collecting mail information transmitted and received between one or more user terminals; According to a preset security threat architecture, matching step-by-step of the mail security process corresponding to the mail information is processed, the mail information is checked by the matching-processed mail security process, and mail security inspection information according to the inspection result is obtained. a security threat inspection step of storing and managing; a mail processing step of processing the mail status according to the mail security check information and security threat determination information obtained through the mail information analysis; and a record management step of storing and managing the mail information processed according to the security threat determination information as record information.

In addition, an apparatus according to an embodiment of the present invention for solving the above problems, a collection unit for collecting mail information transmitted and received between one or more user terminals; According to a preset security threat architecture, matching step-by-step of the mail security process corresponding to the mail information is processed, the mail information is checked by the matching-processed mail security process, and mail security inspection information according to the inspection result is obtained. a security threat inspection unit that stores and manages; a mail processing unit for processing a mail status according to the mail security check information and security threat determination information obtained through analysis of the mail information; and a record management unit for storing and managing the mail information processed according to the security threat determination information as record information.

On the other hand, the method according to an embodiment of the present invention for solving the above problems may be implemented as a program for executing the method or a computer-readable recording medium in which the program is recorded.

According to an embodiment of the present invention, by classifying and analyzing threats into spam emails, attachments containing malicious code, forged URLs, similar domains, and fraudulent contents on the receiving side of the email, and enabling step-by-step threat response processing, Mails sent for malicious purposes can be blocked before the recipient can open them, or they can be converted into harmless mails to the system. In addition, it detects and blocks cybersecurity threats from the sending side of the email, and the internal side of the email management system detects potential threats such as suspected information leakage or inconsistency of IP address information for access to the managed system in advance to prevent it from being used for malicious purposes. Damage can be prevented in advance. In this way, it is possible to provide an e-mail service that guarantees safe information exchange and processing between users by controlling abnormal processing such as hacking, fraud, and spam that can be made through the e-mail system and preventing damage.

1 is a conceptual diagram illustrating an entire system according to an embodiment of the present invention.

2 is a block diagram illustrating an apparatus for providing a mail security service according to an embodiment of the present invention.

3 is a block diagram for explaining in more detail some configurations of an apparatus for providing a mail security service according to an embodiment of the present invention.

4 is a flowchart illustrating a method of operating an apparatus for providing a mail security service according to an embodiment of the present invention.

5 is an exemplary diagram for explaining a checking method according to an architecture of a mail security service according to an embodiment of the present invention.

The following is merely illustrative of the principles of the invention. Therefore, those skilled in the art will be able to devise various devices and methods that, although not explicitly described or shown herein, embody the principles of the present invention and are included within the spirit and scope of the present invention. In addition, all conditional terms and examples listed herein are, in principle, expressly intended only for the purpose of understanding the concept of the present invention, and it should be understood that they are not limited to the specifically enumerated embodiments and states as such. do.

Moreover, it is to be understood that all detailed description reciting specific embodiments, as well as principles, aspects, and embodiments of the invention, are intended to include structural and functional equivalents of such matters. It should also be understood that such equivalents include not only currently known equivalents, but also equivalents developed in the future, i.e., all devices invented to perform the same function, regardless of structure.

Thus, for example, the block diagrams herein are to be understood as representing conceptual views of illustrative circuitry embodying the principles of the invention. Similarly, all flowcharts, state transition diagrams, pseudo code, etc. may be tangibly embodied on computer-readable media and be understood to represent various processes performed by a computer or processor, whether or not a computer or processor is explicitly shown. should be

In addition, the clear use of terms presented as processor, control or similar concepts should not be construed as exclusively referring to hardware having the ability to execute software, and without limitation, digital signal processor (DSP) hardware, ROM for storing software. It should be understood to implicitly include (ROM), RAM (RAM) and non-volatile memory. Other common hardware may also be included.

The above objects, features and advantages will become more apparent through the following detailed description in relation to the accompanying drawings, and accordingly, those of ordinary skill in the art to which the present invention pertains can easily implement the technical idea of the present invention. There will be. In addition, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention in carrying out the present invention, the detailed description thereof will be omitted.

The terms used in the present application are only used to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present application, terms such as “comprise” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, but one or more other features It should be understood that this does not preclude the existence or addition of numbers, steps, operations, components, parts, or combinations thereof.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the accompanying drawings. In describing the present invention, in order to facilitate the overall understanding, the same reference numerals are used for the same components in the drawings, and duplicate descriptions of the same components are omitted.

'Mail' as used herein means e-mail, web mail, e-mail, and Terms such as e-mail can be collectively used.

1 is a conceptual diagram illustrating an entire system according to an embodiment of the present invention.

Referring to FIG. 1 , a system according to an embodiment of the present invention includes a service providing apparatus 100 , a user terminal 200 , and a mail server 300 .

More specifically, the service providing apparatus 100 , the user terminal 200 , and the mail server 300 may be connected to one or more of wired and wireless via a connection to a public network to transmit/receive data. The public network is a communication network built and managed by the country or a telecommunication key business operator. In general, a connection service is provided so that an unspecified number of ordinary people, including a telephone network, a data network, a CATV network, and a mobile communication network, can access other communication networks or the Internet. . In the present invention, the public network is represented by replacing the network.

In addition, the service providing apparatus 100 , the user terminal 200 , and the mail server 300 may include respective communication modules for communicating with a protocol corresponding to each communication network.

The service providing device 100 may be connected to each user terminal 200 and the mail server 300 through a wired/wireless network in order to provide a mail security service, and the device or terminals connected to each network have a preset network channel. can communicate with each other.

Here, each of the networks is a local area network (LAN), a wide area network (WAN), a value added network (VAN), a personal local area network (PAN), a mobile communication network ( Mobile radio communication network) or all types of wired/wireless networks, such as satellite communication networks, may be implemented.

The service providing apparatus 100 described in this specification provides a mail security service capable of detecting and blocking attacks that cause unintended execution of programs through mail, deterioration of data processing capabilities of mail-related systems, and phishing scams. can

And the user terminal 200 described in this specification is a PC (personal computer), a notebook computer (laptop computer), a mobile phone (Mobile phone), a tablet PC (Tablet PC), PDA (Personal Digital Assistants), PMP (Portable Multimedia Player) ), etc. may be included, but the present invention is not limited thereto, and may be a device capable of connecting to the service providing apparatus 100 and the mail server 300 through a public network or a private network.

In addition, each device may be a variety of devices capable of inputting and outputting information through application driving or web browsing. In particular, in general, the user terminals 200 may be connected to the service providing apparatus 100 through an individual security network.

The mail server 300 is a system for relaying and storing e-mail contents so that the user can transmit the mail created through the user terminal 200 or the other party can receive the mail created through the user terminal 200 . The mail server 300 may communicate with each other by using a preset protocol according to the purpose of use of processing receiving and sending mail.

In general, as for the protocol, POP3 (Post Office Protocol 3) and IMAP (Internet Message Access Protocol) may be used when receiving and processing mail. In addition, the protocol may use SMTP (Simple Mail Transfer Protocol) when sending mail. As such, the mail server 300 may be configured and operated as a server system for mail transmission/reception processing. In addition, the mail server 300 may be subdivided into a mail receiving server and a mail sending server to provide respective functions.

2 and 3 are block diagrams for explaining an apparatus for providing a mail security service according to an embodiment of the present invention.

2 and 3 , the service providing apparatus 100 according to an embodiment of the present invention includes a control unit 110 , a collection unit 120 , a security threat inspection unit 130 , a relationship analysis unit 140 , It may include a mail processing unit 150 , a user terminal control unit 160 , a records management unit 170 , a vulnerability test unit 180 , and a communication unit 190 .

The control unit 110 may be implemented as one or more processors for overall controlling the operation of each component of the service providing apparatus 100 .

The collection unit 120 may collect mail information transmitted and received between one or more user terminals 200 . The e-mail information may include e-mail header information, e-mail subject, e-mail content body, number of times received for a certain period, and the like.

Specifically, the email header information includes a mail sending server IP address, mail sending server host name information, sender mail domain information, sender mail address, mail receiving server IP address, mail receiving server host name information, recipient mail domain information, recipient mail It may include an address, mail protocol information, mail reception time information, mail transmission time information, and the like.

In addition, the email header may include network path information necessary for a process of sending and receiving mail, protocol information used between mail service systems for mail exchange, and the like.

Additionally, the mail information may include the extension of the attached file, hash information of the attached file, the name of the attached file, the body of the attached file, Uniform Resource Locator (URL) information, and the like. The attachment may include additional content for transmitting additional information or requesting an information reply in addition to the mail body content that the sender wants to deliver to the receiver.

The content may provide text, an image, a video, and the like. The recipient can check the content by running an application corresponding to the file attached to the mail. In addition, the recipient can download the file attached to the mail to a local storage device and store and manage it.

The extension of the attached file can distinguish the format or type of the file. In general, the extension of the attached file may be divided into a character string indicating a file attribute or an application that created the file. For example, a text file may be divided into [file name].txt, an MS word file may be classified with an extension such as [file name].doc(docx), and a Korean file may be distinguished by an extension such as [file name].hwp. In addition, the image file extension may be divided into gif, jpg, png, tif, and the like.

Executable files, which are computer files that additionally carry out the specified work according to the coded commands, are [file name].com, [file name].exe, [file name].bat, [file name].dll, [file name].sys, [ file name].scr, etc.

The hash information of the attached file can ensure the integrity of the information by checking forgery of the information. The hash information or hash value may be mapped to a bit string of a certain length for arbitrary data having an arbitrary length through a hash function.

Through this, the hash information output through the hash function for the initially created attached file has a unique value. The output hash information or hash value has unidirectionality in that data input to the function cannot be extracted. In addition, the hash function can guarantee collision avoidance that is computationally impossible for another input data that provides the same output as hash information or hash value output with respect to one given input data. Accordingly, when the data of the attached file is modified or added, the output value of the hash function is returned differently.

In this way, the unique hash information of the attached file can be checked whether the file has been modified or forged by comparing the hash information or hash value with respect to a file sent and received through mail. In addition, since the hash information is fixed as a unique value, it is possible to enable proactive prevention measures by using reputation information, which is a database of past histories for files created with malicious intent. Additionally, the hash function may be used as a technology and version that can ensure unidirectionality and collision avoidance.

For example, the hash information may be used as search information for whether or not there is a malicious code in a file through the VirusTotal website or the Malwares website. Information such as a provider of the file and a hash value of the file may be provided through a website that provides analysis of the hash information of the file. In addition, the search result for the hash information of the file can be judged as more reliable information because it can cross-check the reputation information determined by global companies that provide multiple IT information security solutions.

The security threat inspection unit 130 processes matching step-by-step of a mail security process corresponding to the mail information according to a preset security threat architecture, checks the mail information by the matching processed mail security process, and the inspection result It is possible to store and manage mail security inspection information according to

The security threat architecture can be divided into spam email security threats, malicious code security threats, social engineering security threats, and internal information leakage security threats. The security threat type/level/process/priority/processing order may be set by the security threat architecture.

The mail security process corresponding to the security threat architecture may include a spam mail security process, a malicious code security process, an impersonated mail security process, a mail export security process, and the like.

In the mail security process, different mail security processes corresponding to incoming mail or outgoing mail may be determined according to the security threat architecture. In addition, the inspection order or inspection level of the mail security process may be determined by a preset security level and architecture.

In the mail security process, when mail information for reception or transmission is transmitted from the user terminal 200, an independently divided process is allocated as a resource, and a flexible resource allocation method that can be immediately executed in the inspection area allocated from the mail information is It can be described as a virtual space concept. In the method of allocating resources to the virtual space, when the processing is completed, the mail security process can immediately process the task in the inspection area allocated from the sequentially incoming mail information.

In contrast, an environment to which a certain process with limited processing within one resource is assigned, such as a virtual environment or virtual machine, reduces the idle time when other processes wait until the processing of a specific process is completed when processing a requested task. can have As such, in the analysis method through the process, the flexible resource may have an advantage in processing speed and performance compared to the fixed resource.

The security threat inspection unit 130 may classify the mail for the purpose of reception or transmission according to the mail information collected by the collection unit 120 . Thereafter, the security threat inspection unit 130 may acquire mail security inspection information for each mail by matching and analyzing the mail security process sequentially or based on a set priority.

The spam email security threat may include a type of email that is distributed indiscriminately to an unspecified number of people unilaterally and in bulk for the purpose of advertising and publicity between unrelated senders and recipients. In addition, a large amount of spam mail may cause a load on the data processing capability of the mail system, which may cause deterioration of the processing capability of the system. In addition, there is a risk that the spam mail may be unintentionally linked to the indiscriminate information included in the body of the content, and may be disguised as information for potential phishing scams.

In order to detect and filter such spam mail, the security threat inspection unit 130 may include a spam mail inspection unit 131 . When the mail security process is a spam mail security process, the spam mail inspection unit 131 sets the mail information including mail header information, mail title, mail content body, and the number of times received for a certain period in advance with a spam index and step-by-step can be matched with

The spam mail inspection unit 131 may use the mail information including the mail header information, the mail title, and the mail content body as an inspection item in the spam index through a schedule pattern inspection that can be classified as spam mail. Through this, the spam mail inspection unit 131 can acquire, store, and manage spam mail inspection information by matching the spam indicators step by step.

The spam indicator may be set to a level value through inspection items and inspection based on items included in the mail information step by step. According to an embodiment of the present invention, the spam indicator may be subdivided and configured into Level 1, Level 2, Level 3, ..., Level [n].

The spam indicator Level 1 may match the mail title data included in the mail information based on big data and reputation information. Through this, the spam indicator Level 1 can acquire the evaluated level value as the inspection information of the spam indicator Level 1. The level value may be set as information that can be quantitatively measured. For example, when the inspection information of the spam indicator Level 1 includes phrases such as 'advertisement' and 'publicity' in the mail title, which is an inspection item, it matches the information defined as spam in the big data and reputation information. In this case, it can be evaluated as '1' in the level values divided into 0 and 1. Through this, the inspection information of spam indicator Level 1 can be obtained as '1'.

Additionally, the spam indicator Level 2 may match data included in mail information based on a user-specified keyword. Through this, the spam indicator Level 2 can acquire the evaluated level value as the inspection information of the spam indicator Level 2 . For example, the inspection information of the spam indicator Level 2 includes keywords including 'special price', 'super special price', 'sale', 'sale', 'out of stock', etc. When the user-specified keyword matches the information defined as spam mail, it may be evaluated as '1' in a level value divided into 0 and 1. Through this, the inspection information of the spam indicator Level 2 can be obtained as '1'.

As a next step, the spam indicator Level 3 can match data included in mail information based on image analysis. Through this, the spam indicator Level 3 can acquire the evaluated level value as the inspection information of the spam indicator Level 3 . For example, when the inspection information of the spam indicator Level 3 includes a phone number starting with '080' in the data extracted by analyzing the image included in the main body of the mail content, which is the inspection item, the image analysis results in spam mail If it matches the information defined as , it can be evaluated as '1' in the level values divided into 0 and 1. Through this, the inspection information of spam indicator Level 3 can be obtained as '1'.

As described above, the inspection information acquired in units of the spam indicator level through the spam mail security process may be finally summed ('3') and stored and managed as spam mail inspection information. The summed spam mail inspection information may be included in the mail security inspection information and managed, and may be utilized as security threat determination information in the mail processing unit 150 .

The security threat inspection unit 130 may further include a malicious code inspection unit 132 . When the mail security process is a malicious code security process, the malicious code inspection unit 132 further includes the extension of the attached file, hash information of the attached file, the name of the attached file, the body of the attached file, Uniform Resource Locator (URL) information, and the like. It is possible to match the mail information to a preset malicious code index step by step.

The malicious code inspection unit 132 detects the attachment file content body and URL (Uniform Resource Locator) information included in the content body along with the attachment file extension, hash information of the attachment file, attachment file name, etc. It can be used as a malware index inspection item. Through this, the malicious code inspection unit 132 can acquire, store, and manage the malicious code inspection information by matching the malicious code index step by step according to the items.

As for the malicious code index, an inspection item based on an item included in the mail information and a level value through inspection may be set for each step. According to an embodiment of the present invention, the malicious code index may be subdivided and configured into Level 1, Level 2, Level 3, ..., Level [n].

The malicious code indicator Level 1 may match the name of the attached file and the extension of the attached file included in the mail information based on big data and reputation information. Through this, the level value evaluated for the malicious code index Level 1 can be acquired as inspection information of the malicious code index Level 1. For example, when the inspection information of the malicious code indicator Level 1 includes 'Trojan' and the extension of the attached file includes 'exe', the inspection item is defined as malicious code in the big data and reputation information. If the information is matched, it can be evaluated as '1' in the level values divided into 0 and 1. Through this, the inspection information of the malicious code indicator Level 1 can be obtained as '1'.

Additionally, the malicious code indicator Level 2 may match hash information of an attached mail file based on big data and reputation information. Through this, the evaluated level value can be acquired as inspection information of the malicious code indicator Level 2. For example, when the inspection information of the malicious code indicator Level 2 is analyzed as 'a1b2c3d4', the inspection item attachment hash information is the same as the information defined as malicious code in the reputation information, the level is divided into 0 and 1 It may evaluate to '1' in the value. Through this, the inspection information of the malicious code indicator Level 2 can be obtained as '1'.

As a next step, the malicious code indicator Level 3 can match URL (Uniform Resource Locator) information included in an attachment or mail content body based on URL reputation information. Through this, the evaluated level value can be acquired as inspection information of the malicious code indicator Level 3. For example, the inspection information of the malicious code indicator Level 3 is information defined as a harmful site including a malicious code file in the URL reputation information when the URL information, which is an inspection item, is confirmed as 'www.malicious-code.com'. In the case of matching with 0, it can be evaluated as '1' in the level values divided into 0 and 1. Through this, the inspection information of the malicious code indicator Level 3 can be obtained as '1'. In addition, the malicious code inspection unit 132 may respond to a zero-day attack that may be omitted from the URL reputation information. The malicious code inspection unit 132 may change the link IP address for a URL without reputation information to an IP address of a specific system and provide the changed IP address to the user terminal 200 . When the user terminal 200 attempts to access the URL, it may be connected to the IP address of a specific system changed by the malicious code inspection unit 132 . A specific system that has previously been changed to the link IP address for the URL can continuously check whether or not malicious code is included up to the endpoint of the URL.

As described above, the inspection information acquired in units of the malicious code index level through the malicious code security process may be finally summed up ('3') and stored and managed as malicious code inspection information. The summed malicious code inspection information may be included in the mail security inspection information and managed, and may be utilized as security threat determination information in the mail processing unit 150 .

The security threat inspection unit 130 may further include an impersonated mail inspection unit 133 . When the mail security process is an impersonated mail security process, the impersonated mail inspection unit 133 may match the relation analysis information obtained through the relation analysis unit 140 with a preset relation analysis index step by step. The relationship analysis information may be obtained through mail information analysis including mail information and attribute information of mails confirmed as normal.

The impersonated mail inspection unit 133 uses the received mail domain, the outgoing mail domain, the incoming mail address, the outgoing mail address, mail routing, mail content body information, etc. that can be extracted from the mail determined as normal, as relationship analysis index check items. can Through this, the impersonated mail inspection unit 133 may acquire, store, and manage the impersonated mail inspection information by matching the relationship analysis index according to the items step by step. Through this, the impersonated mail inspection unit 133 can detect similar domains and can filter mails that may pose a security threat by tracking or verifying the sending route of the mail.

As for the relation analysis index, the level value through the inspection item and inspection based on the relation analysis information may be set step by step. According to an embodiment of the present invention, the relationship analysis index may be subdivided and configured into Level 1, Level 2, Level 3, ..., Level [n].

The relationship analysis index Level 1 may match the domain of the sender's mail, the address of the sender's mail, and the like, based on reputation information. Through this, the relationship analysis index Level 1 may acquire the evaluated level value as inspection information of the relationship analysis index Level 1. For example, the inspection information of the relational analysis indicator Level 1 is malicious in the reputation information when the domain of the sent mail, which is the inspection item, is '@impersonation.com' and the sender's mail address contains 'impersonation@'. If it matches the information defined by the code, it can be evaluated as '1' in the level values separated by 0 and 1.

Additionally, the relationship analysis indicator Level 2 may match the domain of the sender mail, the address of the sender mail, and the like, based on the relationship analysis information. Through this, the relationship analysis index Level 2 may acquire the evaluated level value as inspection information of the relationship analysis index Level 2 . For example, in the inspection information of the relationship analysis indicator Level 2, when the domain of the outgoing mail, which is an inspection item, is '@impersonation.com' and the sender's mail address includes 'impersonation@', in the relation analysis information If it does not match the information defined as the attribute information of normal mail, it can be evaluated as '1' at the level values divided into 0 and 1. Through this, the inspection information of the relationship analysis index Level 3 can be obtained as '1'.

As a next step, the relationship analysis indicator Level 3 may match mail routing information and the like based on the relationship analysis information. Through this, the relationship analysis index Level 3 can acquire the evaluated level value as inspection information of the relationship analysis index Level 3 . For example, in the inspection information of the relationship analysis indicator Level 3, when mail routing information, which is an inspection item, is checked as '1.1.1.1', '2.2.2.2', and '3.3.3.3', the routing information that is the transmission path of the mail In the relation analysis information, when the information defined as the attribute information of the normal mail does not match, it may be evaluated as '1' in the level values divided into 0 and 1. Through this, the inspection information of the relationship analysis index Level 3 can be obtained as '1'.

As described above, the inspection information obtained by the relationship analysis index level unit through the impersonation mail security process may be finally summed ('3') and stored and managed as the impersonation mail inspection information. The summed up impersonation mail inspection information may be included in the mail security inspection information and managed, and may be utilized as security threat determination information in the mail processing unit 150 .

The security threat inspection unit 130 may include a mail export inspection unit 134 to respond to the security threat of leaking internal information. When the mail security process is the mail export security process, the mail export inspection unit 134 may match the mail export management index set in advance based on the mail information step by step.

The mail export inspection unit 134 may utilize the attribute information of the mail information to be used as a mail export management index inspection item. In addition, as the management index check item, the allocated IP information of the internally managed user terminal 200 may be used.

In the mail export management index, preset inspection items and level values through inspection may be set for each step. According to an embodiment of the present invention, the mail export management index may be subdivided and configured into Level 1, Level 2, Level 3, ..., Level [n].

The mail export management index may include an item for controlling so that only IP addresses allowed from the IP addresses allocated to the user terminal 200 for sending environment inspection can register mail information. Unauthorized user terminals have a relatively high possibility of leaking internal information and a relatively high possibility of threatening security through e-mail, so it is possible to manage management indicators to block this in advance.

In addition, the mail export inspection unit 134 may classify the mail export management index into inspection items such as IP address information and number of times information to be used as a mail export management index. In addition, the mail export inspection unit 134 may additionally include a control unit such as an approval process as a mail sending environment inspection item to reduce the threat of internal information leakage. Through this, the mail delivery inspection unit 134 may store and manage the level value calculated by matching the check item through the mail delivery process as mail delivery inspection information.

The relationship analysis unit 140 may store and manage the relationship analysis information obtained based on the analysis of the mail information and the trust authentication log. The trust authentication log is a received mail domain, an outgoing mail domain, an incoming mail address, an outgoing mail address, mail routing, and mail content body when the record management unit 170 processes mail information as normal mail according to the security threat determination information. It may include record information including information and the like.

The mail processing unit 150 may process the mail status according to the mail security check information and security threat determination information obtained through the mail information analysis.

The mail processing unit 150 may perform the mail security process according to a preset priority. When the security threat determination information through the mail security process is determined to be an abnormal mail, the mail processing unit 150 may determine whether to stop the subsequent mail security process and process the mail status. Through this, when a problem is found in the first inspection step according to the priority, the mail processing unit 150 performs only the necessary processing in that step and determines whether the inspection is finished, so that the subsequent inspection step is not performed. Through this, it is possible to secure the efficiency of the mail security service, thereby lowering the complexity of the system and improving the processing efficiency.

The mail security inspection information may utilize information obtained by synthesizing spam mail inspection information, malicious code inspection information, impersonation mail inspection information, and mail export inspection information calculated by the security threat inspection unit 130 . For example, when the security threat inspection unit 130 performs a process on the mail information, the score calculated from the spam mail inspection information is '3', the score calculated from the malicious code inspection information is '2', and the impersonated mail When the score calculated by the inspection information '1' and the mail export inspection information is '0', the score summed into the mail security inspection information may be obtained as '7'. At this time, based on the preset security threat identification information, when the overall score is in the range of 0-3, it can be classified as normal mail, when it is in the range of 4-6, it can be classified as gray mail, and when it is in the range of 7-12, it can be classified as abnormal mail. Accordingly, the mail having the mail security check information of '7' may be determined as abnormal mail. In addition, the result value of each inspection information item included in the mail information inspection information may be given an absolute priority according to the item, or may be prioritized with information according to a weight.

The mail processing unit 150 may include a mail distribution processing unit 151 that processes the mail determined as normal mail according to the security threat determination information into a receiving or sending state that the user terminal can handle.

In addition, the mail processing unit 150 may further include a mail disposal processing unit 152 for processing the mail determined as abnormal mail according to the security threat determination information in a state in which the user terminal cannot access it.

Additionally, the mail processing unit 150 converts the gray mail into non-executable file contents for the mail determined as gray mail according to the security threat determination information, and provides the user terminal to selectively process the mail status It may further include a mail detoxification processing unit (153).

In general, the gray mail may be classified into spam mail or junk mail, and conversely, may be classified as normal mail. In the present invention, the gray mail can be defined as a mail type that is distinguished when the security threat determination information is calculated as an intermediate value within a certain range that cannot be determined as normal or abnormal. The mail detoxification processing unit 153 may convert the gray mail including the body of suspicious content into an image file and provide the mail in a state that the user terminal 200 can check. In addition, the mail detoxification processing unit 153 may remove or modify a section suspected of malicious code in the attached file and provide it to the user terminal 200 .

The user terminal control unit 160 controls the transmission of the mail information when the IP address (Internet Protocol Address) information used by the user terminal 200 in the network corresponds to a preset unauthorized IP address. can do.

The record management unit 170 may store and manage the mail information processed according to the security threat determination information as record information. When the record management unit 170 is processed as a normal mail according to the security threat determination information, the record including a receiving mail domain, an outgoing mail domain, a receiving mail address, an outgoing mail address, mail routing, mail content body information, etc. It may further include a relationship information management unit 171 that stores and manages the information as a trust authentication log. Through this, the trust authentication log can be utilized for reliable relationship information analysis with respect to the recipient and sender mail information. In addition, the reliability of the information included in the trust authentication log can be guaranteed as data is continuously accumulated through mutual information exchange.

In addition, when the records management unit 170 is processed as an abnormal mail according to the security threat determination information, the received mail domain, the outgoing mail domain, the received mail address, the outgoing mail address, mail routing, mail content body information, etc. Record information can be used as an indicator for determining abnormal mail when performing the mail security process.

Vulnerability test unit 180 converts the abnormal mail into non-executable file contents for mail determined as abnormal mail according to the security threat determination information so that it can be received or sent from the user terminal. . The vulnerability test unit 180 may include a vulnerability information management unit 181 that acquires the identification information of the user terminal that has been received or sent with respect to the abnormal mail, stores and manages it as vulnerability information for each type.

4 is a flowchart illustrating a method of operating an apparatus for providing a mail security service according to an embodiment of the present invention.

Referring to FIG. 4 , in the method of operating the apparatus for providing a mail security service, in the collecting step S101 , mail information transmitted and received between one or more user terminals 200 may be collected.

The security threat check step S103 may process step-by-step matching of a mail security process corresponding to the mail information according to a preset security threat architecture. Thereafter, in the security threat checking step ( S103 ), the mail information may be checked by the matching-processed mail security process. Through this, the security threat inspection step (S103) may store and manage mail security inspection information according to the inspection result.

In the mail security process, different mail security processes corresponding to incoming mail or outgoing mail may be determined according to the security threat architecture. In addition, the inspection order or inspection level of the mail security process may be determined by a preset security level and architecture.

In the mail processing step (S105), the mail status may be processed according to the mail security check information and security threat determination information obtained through the mail information analysis.

In the mail processing step (S105), the mail security process according to a preset priority may be performed. In the mail processing step (S105), when the security threat determination information through the mail security process is determined to be an abnormal mail, it is possible to determine whether to stop the subsequent mail security process and process the mail status. Through this, in the mail processing step (S105), if a problem is found in the first inspection step according to the priority, only the necessary processing is performed in that step, and it is determined whether the inspection is finished, and the subsequent inspection step is not performed. Through this, it is possible to secure the efficiency of the mail security service, thereby lowering the complexity of the system and improving the processing efficiency.

In the record management step (S107), the mail information processed according to the security threat determination information may be stored and managed as record information. In the record management step (S107), when normal mail is processed according to the security threat determination information, the received mail domain, the outgoing mail domain, the received mail address, the outgoing mail address, mail routing information, the mail content body, etc. are included. It may further include a relationship information management step of storing and managing the record information as a trust authentication log.

The relation analysis step (not shown) may store and manage relation analysis information obtained based on the analysis of the mail information and the trust authentication log.

In the security threat inspection step (S103), when the mail security process is a spam mail security process, the e-mail information including one or more of e-mail header information, e-mail subject, e-mail content body, and the number of times received for a certain period is set in advance. It may further include a spam check step matching the indicator and step-by-step. Additionally, in the security threat checking step (S103), if the mail security process is a malicious code security process, one of the attachment file extension, attachment file hash information, attachment file name, attachment file content body, and URL (Uniform Resource Locator) information The method may further include a malicious code checking step of matching the mail information including the above with a preset malicious code index step by step. In addition, the security threat checking step ( S103 ) may further include an impersonated mail checking step of matching step-by-step with a relationship analysis index preset with respect to the relationship analysis information when the mail security process is an impersonated mail security process. In addition, the security threat checking step (S103) may further include, when the mail security process is a mail export security process, matching the mail export management index set in advance based on the mail information step-by-step. .

The mail processing step (S105) may further include a mail distribution processing step of processing the mail determined as normal mail according to the security threat determination information to a reception or transmission state that the user terminal can handle. In addition, the mail processing step (S105) may further include a mail disposal processing step of processing the mail determined as abnormal mail according to the security threat determination information in a state in which the user terminal cannot access it.

Additionally, in the mail processing step (S105), the gray mail is converted into non-executable file contents for the mail determined as gray mail according to the security threat determination information, and the user terminal can selectively process the mail status. It may further include a mail detoxification processing step to provide.

Vulnerability testing step (not shown) converts the abnormal mail into non-executable file contents for mail determined as abnormal mail according to the security threat determination information so that it can be received or sent from the user terminal. can The vulnerability testing step may further include a vulnerability information management step of acquiring identification information of the user terminal that has been received or transmitted with respect to the abnormal mail, and storing and managing it as vulnerability information for each type.

5 is an exemplary diagram for explaining a checking method according to an architecture of a mail security service according to an embodiment of the present invention.

Referring to FIG. 5 , as an architecture for providing a mail security service, types and levels of security threats, processes, priorities, processing orders, etc. may be set accordingly. The architecture of the mail security service is divided into top categories such as incoming mail, outgoing mail, internal mail, and user education, and hierarchical and stepwise configuration and processing methods can be applied as a substructure for each category. The uppermost category may be classified according to the classification of the accessing system according to the attribute value included in the mail information or the purpose of using the mail of the user terminal 200 .

Within each security threat type, one or more specific mail security processes can be assigned, which can be divided into levels and executed in stages and sequentially. In detail, security threat types can be classified into security threat types such as SPAM, Malicious code (Attachment), Malicious code (URL), and Social Engineering Attack. Accordingly, the security threat type inspection process may be sequentially implemented. In addition, within each of the above security threat types, it may be divided into levels 1, 2, 3, ... [n] and sequentially implemented. At this time, each level is assigned a specific item to be inspected and an indicator, so that an inspection result can be obtained.

Also, depending on the architecture setting, the mail security process within each security threat type can also be performed in parallel with the assigned scan area.

The received mail, which is one of the top categories, may be classified into a security threat type as a lower layer. In detail, the security threat types may be classified into SPAM processing, malicious code processing, social engineering processing, and the like.

Level 1 (Lv.1) in the SPAM processing section can check whether or not spam emails are based on reputation for security threat inspection of incoming emails. After that, if there are no problems found in the reputation-based spam inspection, level 2 (Lv.

After the execution of level 2 is completed, the next step, level 3 (Lv.3), can check whether there is spam mail through image-based content analysis. In this way, the mail security service architecture performs level-by-level verification through a specific spam filtering process within the SPAM processing type, and when the verification is completed, it enables transition to the next level. In addition, the mail security service architecture may proceed to the malicious code processing step of determining whether or not malicious code is included in the mail after completing the spam check of the mail through SPAM processing.

The malicious code processing can determine whether level 1 reputation-based malicious code is included, and when normalization is confirmed, the next step can be performed. When the level n (Lv.n) is determined as an attachment that may contain malicious code, the malicious code processing step can be terminated through detoxification processing that transforms the executable code included in the attached file. When the malicious code processing inspection is completed, the inspection step may be transferred to a social engineering processing inspection step. The social engineering processing inspection step executes the social engineering attack mail inspection process based on level 1 (Lv.1) metadata and level n (Lv.n) relationship analysis, and then processes the response according to the inspection result information Or you can request it.

The outgoing mail, which is one of the top categories, may be classified into a security threat type as a lower layer. The category of outgoing mail is also divided into SPAM processing, malicious code processing, and social engineering processing steps like the security threat type of incoming mail, and inspection can be performed.

In particular, the security threat inspection of outgoing mail may include a sending environment inspection step. In the sending environment inspection step, when one or more user terminals 200 access the system for the purpose of sending mail, a level 1 (Lv. can be done When the user terminal 200 authenticated through the level 1 step verification meets within a predetermined reference number with respect to the number of mail transmissions, it may be determined as a normal mail and proceed to the next step. After that, in the level n (Lv.n) step, a process of determining whether or not there is an abnormality by pre-examining the contents of the outgoing mail may be executed to verify whether the mail is normal.

The internal mail, which is one of the top categories, may be subjected to an internal mail management step capable of preventing internal information leakage to a lower layer. The internal mail management step may check for abnormal mail through the level 1 (Lv.1) approval process. The approval process may determine the risk of information leakage with respect to the mail including internal information.

The approval process may be performed in such a way that the mail contents sequentially approved by the mail management system and sent to the outside are pre-censored. Thereafter, the DLP (Data Loss Prevention) and DRM (Digital Rights Management) control process is performed as a level 2 (Lv.2) step to check whether internal information is leaked. The DLP control process can detect and control an action that attempts to transmit information by accessing a system that violates the policy without permission such as approval. The DRM control process can detect and control an attempt to attach an encrypted internal document to an e-mail or a decrypted file without permission such as approval. Thereafter, in the level n (Lv.n) step, when a mail is to be transmitted, a multi-step authentication process such as step 1 or step 2 may be provided as an authentication processing step of the user terminal 200 . Through this, normal mail processing can be ensured by blocking users who attempt to steal or steal accounts.

The user education, which is one of the top categories, may include a stage of mock phishing and a feedback system as a lower layer. In the mock phishing step, it is possible to store and manage information such as the identification value and number of times of the user terminal 200 having a history of using a mail containing a security threat. As the security threat, mail configured in a way that is harmless to an actual system or content may be used. Through this, the feedback system can provide statistical values calculated through simulated phishing or the results of analyzing the threat level.

The security threat check configured for each category may be determined by architecture and security level. Accordingly, an inspection order and an inspection level may be determined, and an abnormality may be checked according to the sequential inspection. In addition, the priority of the inspection order and inspection level may be set according to the architecture and security level. In the process performed according to the priority, when a problem is found according to the obtained inspection result, necessary processing may be performed at that stage and it may be determined whether the inspection is terminated. The above problem can be solved by processing such as discarding or returning the mail so that it cannot be checked in the user terminal 200 when it is determined as spam mail or mail containing malicious code. In this way, when mail problems are handled through the inspection process at a specific stage, the subsequent inspection stage or the remaining inspection stages in parallel processing may be terminated without being performed.

The method according to the present invention described above may be produced as a program to be executed by a computer and stored in a computer-readable recording medium. Examples of the computer-readable recording medium include ROM, RAM, CD-ROM, magnetic tape. , a floppy disk, an optical data storage device, and the like, and also includes those implemented in the form of a carrier wave (eg, transmission through the Internet).

The computer-readable recording medium is distributed in a network-connected computer system, so that the computer-readable code can be stored and executed in a distributed manner. In addition, functional programs, codes, and code segments for implementing the method can be easily inferred by programmers in the art to which the present invention pertains.

In addition, although preferred embodiments of the present invention have been illustrated and described above, the present invention is not limited to the specific embodiments described above, and the technical field to which the present invention pertains without departing from the gist of the present invention as claimed in the claims Various modifications are possible by those of ordinary skill in the art, and these modifications should not be individually understood from the technical spirit or perspective of the present invention.

Claims (20)

1. In the service providing device,

   a collection unit for collecting mail information transmitted and received between one or more user terminals;

   According to a preset security threat architecture, matching step-by-step of the mail security process corresponding to the mail information is processed, the mail information is checked by the matching-processed mail security process, and mail security inspection information according to the inspection result is obtained. a security threat inspection unit that stores and manages;

   a mail processing unit for processing the mail status according to the mail security check information and security threat determination information obtained through the mail information analysis; and

   A record management unit for storing and managing the mail information processed according to the security threat determination information as record information;

   Service providing device.
2. The method of claim 1,

   The records management unit,

   When processed as normal mail according to the security threat determination information, the record information including at least one of a receiving mail domain, an outgoing mail domain, an incoming mail address, an outgoing mail address, mail routing, and mail content body information is trusted authentication log Relational information management unit to store and manage as; further comprising

   Service providing device.
3. 3. The method of claim 2,

   A relationship analysis unit for storing and managing the relationship analysis information obtained based on the analysis of the mail information and the trust authentication log; further comprising

   Service providing device.
4. 4. The method of claim 3,

   The security threat inspection unit,

   When the mail security process is a spam mail security process, a spam mail inspection unit that matches the mail information including one or more of email header information, email subject, email content body, and the number of times received for a certain period with a preset spam index step by step including;

   Service providing device.
5. 5. The method of claim 4,

   The security threat inspection unit,

   When the mail security process is a malicious code security process, the mail information further including one or more of an attachment file extension, attachment file hash information, attachment file name, attachment file content body, and URL (Uniform Resource Locator) information is obtained in advance. A malicious code inspection unit that matches the set malicious code index step by step; further comprising

   Service providing device.
6. 6. The method of claim 5,

   The security threat inspection unit,

   When the mail security process is an impersonated mail security process, an impersonated mail inspection unit that matches step-by-step with a relationship analysis index preset for the relationship analysis information; further comprising

   Service providing device.
7. 7. The method of claim 6,

   The security threat inspection unit,

   When the mail security process is a mail export security process, a mail export inspection unit that matches step-by-step with a mail export management index set in advance based on the mail information; further comprising

   Service providing device.
8. The method of claim 1,

   The mail processing unit,

   a mail distribution processing unit that processes the mail determined as normal mail according to the security threat determination information into a receiving or sending state that can be processed by the user terminal; and

   Including a;

   Service providing device.
9. 9. The method of claim 8,

   The mail processing unit,

   With respect to the mail determined to be gray mail according to the security threat determination information, the gray mail is converted into non-executable file contents, and a mail detoxification processing unit that provides the user terminal to selectively process the mail status; containing

   Service providing device.
10. The method of claim 1,

    A vulnerability testing unit that converts the abnormal mail into non-executable file contents for mail determined as abnormal mail according to the security threat determination information so that it can be received or sent from the user terminal; further comprising a

    Service providing device.
11. 11. The method of claim 10,

    The vulnerability testing unit,

    A vulnerability information management unit that acquires the identification information of the user terminal, which has been received or sent with respect to the abnormal mail, and stores and manages it as vulnerability information by type; including a

    Service providing device.
12. 5. The method of claim 4,

    The email header information includes mail sending server IP address, mail sending server host name information, sender mail domain information, sender mail address, mail receiving server IP address, mail receiving server host name information, recipient mail domain information, recipient mail address, mail protocol information, mail reception time information, and mail sending time information

    Service providing device.
13. The method of claim 1,

    In the mail security process, different mail security processes corresponding to incoming mail or outgoing mail are determined according to the security threat architecture,

    The inspection order or inspection level of the mail security process is determined by a preset security level and architecture.

    Service providing device.
14. The method of claim 1,

    The mail processing unit,

    When the security threat determination information obtained through the mail security process according to the preset priority is determined to be an abnormal mail, it is determined whether the subsequent mail security process is stopped and the mail status is processed.

    Service providing device.
15. In the method of operating a service providing device,

    a collection step of collecting mail information transmitted and received between one or more user terminals;

    According to a preset security threat architecture, matching step-by-step of the mail security process corresponding to the mail information is processed, the mail information is checked by the matching-processed mail security process, and mail security inspection information according to the inspection result is obtained. a security threat inspection step of storing and managing;

    a mail processing step of processing the mail status according to the mail security check information and security threat determination information obtained through the mail information analysis; and

    A record management step of storing and managing the mail information processed according to the security threat determination information as record information; including a

    How the service providing device works.
16. 16. The method of claim 15,

    The record management step is

    In the case where normal mail is processed according to the security threat determination information, the record information including one or more of a receiving mail domain, an outgoing mail domain, an incoming mail address, an outgoing mail address, mail routing information, and the body of the mail content is trusted authentication log Relational information management step of storing and managing as; further comprising

    How the service providing device works.
17. 17. The method of claim 16,

    Relation analysis step of storing and managing the relationship analysis information obtained based on the analysis of the mail information and the trust authentication log; further comprising

    How the service providing device works.
18. 18. The method of claim 17,

    The security threat inspection step is

    When the mail security process is a spam mail security process, the spam mail check that matches the mail information including one or more of email header information, email title, email content body, and the number of times received for a certain period with a preset spam index step by step step;

    If the mail security process is a malicious code security process, preset the mail information including one or more of an attachment file extension, attachment file hash information, attachment file name, attachment file content body, and URL (Uniform Resource Locator) information. A malicious code inspection step that matches one malicious code index step by step;

    when the mail security process is an impersonated mail security process, an impersonated mail checking step of matching with a relationship analysis index preset with respect to the relationship analysis information step by step; and

    When the mail security process is a mail export security process, a mail export check step of matching step-by-step with a mail export management index set in advance based on the mail information; further comprising

    How the service providing device works.
19. 16. The method of claim 15,

    The mail processing step is

    a mail distribution processing step of processing the mail determined to be normal mail according to the security threat determination information into a receiving or sending state that can be processed by the user terminal;

    a mail disposal processing step of processing the mail determined as abnormal mail according to the security threat determination information in a state in which the user terminal cannot access; and

    A mail detoxification processing step of converting the gray mail into non-executable file contents for the mail determined as gray mail according to the security threat determination information, and providing the user terminal to selectively process the mail status; more containing

    How the service providing device works.
20. 16. The method of claim 15,

    Vulnerability testing step of converting the abnormal mail into non-executable file contents for mail determined as abnormal mail according to the security threat determination information so that it can be received or sent from the user terminal; further comprising

    How the service providing device works.

Images